Sometime today all our monitoring dashboards went red.
First impressions are that it looks like a DDoS. After some more investigation we identify about 60k requests per sec coming from about 10 IP addresses. Too small an IP range for an actual DDoS, so what’s going on?
Turns out it’s GoogleBot and OpenAI’s ChatGPT bot hammering one specific url with seemingly random query parameters over and over again.
Thankfully easy enough to block, but why have they suddenly decided to hammer that one URL with a combined 60k req/sec? Where did they get those query parameters from? Even now that we’ve blocked them for 12 hours they’re still at it. Why?!?!
I guess I’ll never know 🤷♂️
First impressions are that it looks like a DDoS. After some more investigation we identify about 60k requests per sec coming from about 10 IP addresses. Too small an IP range for an actual DDoS, so what’s going on?
Turns out it’s GoogleBot and OpenAI’s ChatGPT bot hammering one specific url with seemingly random query parameters over and over again.
Thankfully easy enough to block, but why have they suddenly decided to hammer that one URL with a combined 60k req/sec? Where did they get those query parameters from? Even now that we’ve blocked them for 12 hours they’re still at it. Why?!?!
I guess I’ll never know 🤷♂️
1
